rightsize 0.1.2 → 0.2.0

package/dist/core/reaper/watchdog.js

@@ -0,0 +1,412 @@
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import * as fsSync from "node:fs";
+import * as fsp from "node:fs/promises";
+import * as path from "node:path";
+export function watchdogDir(cacheDir) {
+    return path.join(cacheDir, "reaper");
+}
+/**
+ * `watchdog-<12 hex of SHA-256(content)>.<ext>` — the filename derives from the
+ * script's own bytes. The `reaper/` directory is shared with the sibling rightsize
+ * libraries (Kotlin, Rust) and with other versions of this package, each shipping
+ * its own script with its own argv contract; content-derived names make it
+ * impossible to execute a script whose contract this code doesn't match, and
+ * impossible for a write to clobber a script another process's `sh` is executing.
+ * Exported for tests.
+ */
+export function watchdogScriptFilename(content) {
+    const hash = createHash("sha256").update(content).digest("hex").slice(0, 12);
+    return process.platform === "win32" ? `watchdog-${hash}.js` : `watchdog-${hash}.sh`;
+}
+/**
+ * POSIX `sh` driver: blocks reading stdin until EOF (the invoking rightsize
+ * process holds the other end of the pipe; EOF means that process is gone,
+ * cleanly or via SIGKILL), then reaps every sandbox/network the run tracked
+ * and deletes its three ledger files. Written once under its content-derived
+ * name (see watchdogScriptFilename) — this file is never hand-edited, and
+ * each command prefix arrives via argv (word-split on spaces) rather than
+ * being baked into the script, so a unit test can substitute a stub recorder
+ * command without touching this file's content at all.
+ */
+function posixScriptContent() {
+    return `#!/bin/sh
+# rightsize reaper watchdog — generated file, named by its own content hash.
+# argv: <sandboxesPath> <networksPath> <recordPath> <stopCmd> <removeCmd> <removeNetworkCmd>
+# Each *Cmd is a single space-joined argv prefix (may be empty); the name
+# being reaped is appended as the final argument.
+set -u
+
+SANDBOXES="$1"
+NETWORKS="$2"
+RECORD="$3"
+STOP_CMD="$4"
+REMOVE_CMD="$5"
+REMOVE_NET_CMD="$6"
+
+# Block here until the holder of the pipe's write end exits — cleanly or via
+# SIGKILL, either way the OS closes that fd for us and this read hits EOF.
+cat >/dev/null
+
+# msb's shared state-database migration race (see isMsbStateDbError in the
+# TypeScript backend) can fail a stop/rm exactly the same way it can fail a
+# boot; retried once, same as the library's own in-process retry policy.
+# Harmless no-op against docker's "docker rm -f" output, which never matches.
+run_cmd() {
+  prefix="$1"
+  name="$2"
+  [ -z "$prefix" ] && return 0
+  # shellcheck disable=SC2086 -- intentional word-splitting of the prefix
+  out=$($prefix "$name" 2>&1)
+  if printf '%s' "$out" | grep -q "error: database error:"; then
+    # shellcheck disable=SC2086
+    $prefix "$name" >/dev/null 2>&1
+  fi
+  return 0
+}
+
+if [ -f "$SANDBOXES" ]; then
+  while IFS= read -r name || [ -n "$name" ]; do
+    [ -z "$name" ] && continue
+    run_cmd "$STOP_CMD" "$name"
+    run_cmd "$REMOVE_CMD" "$name"
+  done < "$SANDBOXES"
+fi
+
+if [ -f "$NETWORKS" ]; then
+  while IFS= read -r net || [ -n "$net" ]; do
+    [ -z "$net" ] && continue
+    run_cmd "$REMOVE_NET_CMD" "$net"
+  done < "$NETWORKS"
+fi
+
+rm -f "$SANDBOXES" "$NETWORKS" "$RECORD"
+`;
+}
+/**
+ * Windows driver — a plain Node.js script, NOT PowerShell. Two things were
+ * proven directly (RIGHTSIZE_REAPER_DEBUG=1 evidence, see the investigation
+ * this replaces in git history) rather than assumed:
+ *
+ * 1. On Windows, a NON-detached child of this process is killed by the OS
+ *    itself the instant this process is torn down (SIGKILL or otherwise),
+ *    regardless of what the child is doing — confirmed with a minimal,
+ *    PowerShell/msb-independent control experiment (a plain `node -e`
+ *    heartbeat writer stopped heartbeating within a few hundred ms of the
+ *    owner's kill). This is Windows Job Object semantics: Node/libuv ties a
+ *    non-detached child to a job object that the OS closes (and, with it,
+ *    terminates every member process) when the owner's own job handle
+ *    closes. `detached: true` opts out of that job.
+ * 2. `detached: true` reliably lets an ORDINARY process survive — the same
+ *    control experiment's detached variant kept heartbeating for the full
+ *    60s+ test window, well past the owner's death. But BOTH PowerShell
+ *    hosts available on Windows (legacy `powershell` and `pwsh`) die within
+ *    ~200ms of being spawned with `detached: true`, before running a
+ *    single script line, independent of whether the owner has even been
+ *    killed yet — `DETACHED_PROCESS` (what `detached: true` maps to on
+ *    win32) appears fatal to launching either PowerShell host via `-File`,
+ *    not a version-specific ConsoleHost quirk.
+ *
+ * Put together: the fix isn't a different PowerShell invocation shape, it's
+ * not using PowerShell at all. `node` itself is proven to survive
+ * `detached: true` on this exact platform, so the Windows watchdog is
+ * `node <this script>.js <args>`, `detached: true` — the SAME reap/cleanup
+ * sequence as the POSIX `sh` script, just polling for the owner's pid
+ * (`process.kill(pid, 0)` — the exact liveness primitive
+ * process-liveness.ts's cross-platform sweep already uses successfully on
+ * Windows) every 500ms instead of blocking on stdin EOF (which POSIX can
+ * do safely — see posixScriptContent's doc — but which this investigation
+ * separately found unreliable on Windows before settling on the job-object
+ * explanation above; moot once nothing here reads stdin at all).
+ *
+ * Emits timestamped checkpoint lines to `<RecordPath's directory>\
+ * watchdog-trace-<PID>.log` when `RIGHTSIZE_REAPER_DEBUG=1` is set in this
+ * process's OWN environment (inherited from whatever spawned it) — see
+ * watchdogTracePath.
+ */
+function windowsScriptContent() {
+    return `// rightsize reaper watchdog — generated file, named by its own content hash.
+// argv: <sandboxesPath> <networksPath> <recordPath> <stopCmd> <removeCmd> <removeNetworkCmd> <ownerPid>
+// Each *Cmd is a single space-joined argv prefix (may be empty); the name
+// being reaped is appended as the final argument.
+"use strict";
+const fs = require("fs");
+const path = require("path");
+const { spawnSync } = require("child_process");
+
+const [sandboxesPath, networksPath, recordPath, stopCmd, removeCmd, removeNetCmd, ownerPidRaw] = process.argv.slice(2);
+const ownerPid = Number(ownerPidRaw);
+
+const debugOn = process.env.RIGHTSIZE_REAPER_DEBUG === "1";
+const tracePath = path.join(path.dirname(recordPath), \`watchdog-trace-\${process.pid}.log\`);
+function trace(msg) {
+  if (!debugOn) return;
+  try {
+    fs.appendFileSync(tracePath, \`[\${new Date().toISOString()}] \${msg}\\n\`);
+  } catch {
+    // best-effort diagnostics only
+  }
+}
+
+trace("started");
+trace(\`params: ownerPid=[\${ownerPid}] stopCmd=[\${stopCmd}] removeCmd=[\${removeCmd}] removeNetCmd=[\${removeNetCmd}]\`);
+
+// process.kill(pid, 0) sends no signal, just checks existence — the same
+// primitive process-liveness.ts's isProcessAlive uses, cross-platform.
+function ownerAlive() {
+  try {
+    process.kill(ownerPid, 0);
+    return true;
+  } catch (err) {
+    return err && err.code === "EPERM";
+  }
+}
+
+function splitPrefix(cmd) {
+  return cmd.length === 0 ? [] : cmd.split(" ");
+}
+
+// msb's shared state-database migration race (see isMsbStateDbError in the
+// TypeScript backend) can fail a stop/rm exactly the same way it can fail a
+// boot; retried once, same as the library's own in-process retry policy.
+// Harmless no-op against docker's "docker rm -f" output, which never matches.
+function runCmd(prefix, name) {
+  const words = splitPrefix(prefix);
+  if (words.length === 0) return;
+  const [exe, ...rest] = words;
+  const args = [...rest, name];
+  const run = () => {
+    const res = spawnSync(exe, args, { encoding: "utf8" });
+    return (res.stdout || "") + (res.stderr || "");
+  };
+  const out = run();
+  if (out.includes("error: database error:")) {
+    run();
+  }
+}
+
+function reapLines(filePath, cmds) {
+  if (!fs.existsSync(filePath)) return;
+  const names = fs.readFileSync(filePath, "utf8").split("\\n").filter((l) => l.length > 0);
+  for (const name of names) {
+    for (const cmd of cmds) {
+      if (cmd === undefined) continue;
+      trace(\`\${cmd === stopCmd ? "stop" : cmd === removeCmd ? "remove" : "remove-net"} \${name}\`);
+      runCmd(cmd, name);
+    }
+  }
+}
+
+function poll() {
+  const pollCountKey = "__rzPollCount";
+  poll[pollCountKey] = (poll[pollCountKey] || 0) + 1;
+  const n = poll[pollCountKey];
+  if (n === 1 || n % 20 === 0) {
+    trace(\`poll #\${n}: ownerAlive(\${ownerPid}) -> \${ownerAlive()}\`);
+  }
+  if (ownerAlive()) {
+    setTimeout(poll, 500);
+    return;
+  }
+  trace("owner gone");
+  reapLines(sandboxesPath, [stopCmd, removeCmd]);
+  reapLines(networksPath, [removeNetCmd]);
+  trace("removing ledger files");
+  for (const p of [sandboxesPath, networksPath, recordPath]) {
+    try {
+      fs.unlinkSync(p);
+    } catch {
+      // already gone — fine
+    }
+  }
+  trace("done");
+}
+
+poll();
+`;
+}
+/** Writes the platform-appropriate watchdog script under `<cacheDir>/reaper/` (skipped when its content-named file already exists) and returns its path. */
+export async function ensureWatchdogScript(cacheDir) {
+    const dir = watchdogDir(cacheDir);
+    await fsp.mkdir(dir, { recursive: true });
+    const content = process.platform === "win32" ? windowsScriptContent() : posixScriptContent();
+    const scriptPath = path.join(dir, watchdogScriptFilename(content));
+    try {
+        await fsp.access(scriptPath);
+        return scriptPath; // the filename encodes the content, so presence means identity
+    }
+    catch {
+        // absent — write below
+    }
+    const tmpPath = `${scriptPath}.${process.pid}.tmp`;
+    await fsp.writeFile(tmpPath, content);
+    if (process.platform !== "win32") {
+        await fsp.chmod(tmpPath, 0o755);
+    }
+    try {
+        await fsp.rename(tmpPath, scriptPath);
+    }
+    catch (err) {
+        // A concurrent writer beat us to it with identical bytes; otherwise re-throw.
+        await fsp.rm(tmpPath, { force: true });
+        try {
+            await fsp.access(scriptPath);
+        }
+        catch {
+            throw err;
+        }
+    }
+    return scriptPath;
+}
+function joinPrefix(prefix) {
+    return prefix.join(" ");
+}
+/**
+ * `RIGHTSIZE_REAPER_DEBUG=1` turns on the watchdog spawn diagnostics below —
+ * off by default (production spawns never pay for the extra file opens or
+ * the diagnostics IO). Meant to be set for a single CI debug run, not left
+ * on permanently, though the affordance itself is cheap enough to ship.
+ */
+function reaperDebugEnabled() {
+    return process.env["RIGHTSIZE_REAPER_DEBUG"] === "1";
+}
+/** The run id a ledger path was generated for — `runs/<run-id>.sandboxes` etc. */
+function runIdFromSandboxesPath(sandboxesPathValue) {
+    return path.basename(sandboxesPathValue).replace(/\.sandboxes$/, "");
+}
+/**
+ * Paths the debug affordance below writes to when `RIGHTSIZE_REAPER_DEBUG=1`
+ * — the watchdog's own stdout/stderr (normally `"ignore"`d) plus a meta log
+ * of spawn/error/exit events, all under the same `reaper/` directory the
+ * watchdog script itself lives in. Exported so a test can locate them
+ * without duplicating the naming scheme.
+ */
+export function watchdogDebugPaths(cacheDir, runId) {
+    const dir = watchdogDir(cacheDir);
+    return {
+        out: path.join(dir, `watchdog-${runId}.debug.out.log`),
+        err: path.join(dir, `watchdog-${runId}.debug.err.log`),
+        meta: path.join(dir, `watchdog-${runId}.debug.meta.log`),
+    };
+}
+/**
+ * Where the Windows script's own in-script trace (see windowsScriptContent's
+ * doc) lands: same directory as the run record, named by the watchdog
+ * process's own pid — the one piece of the script's identity a caller can
+ * know ahead of the script writing anything itself. POSIX has no equivalent
+ * (its script has no such tracing; its debug story is the stdout/stderr
+ * capture above, which is enough there since `sh -x` isn't needed to tell
+ * the difference between "never started" and "died partway").
+ */
+export function watchdogTracePath(recordPathValue, pid) {
+    return path.join(path.dirname(recordPathValue), `watchdog-trace-${pid}.log`);
+}
+function appendDebugLine(filePath, line) {
+    try {
+        fsSync.appendFileSync(filePath, `[${new Date().toISOString()}] ${line}\n`);
+    }
+    catch {
+        // Best-effort diagnostics only — never let a debug-log write failure
+        // affect the watchdog spawn itself.
+    }
+}
+/**
+ * Spawns the watchdog detached, unref()'d so it never keeps this process's
+ * event loop alive.
+ *
+ * On POSIX, its stdin is a pipe whose write end ONLY this process holds —
+ * that write end is `handle.process.stdin`, returned so the caller can
+ * keep a live reference for the rest of the process's life (letting it get
+ * garbage-collected or explicitly closing it would arm the watchdog
+ * early). `detached: true` there just means the standard POSIX
+ * survive-your-parent behavior (setsid); this has always worked and this
+ * investigation never found a POSIX failure.
+ *
+ * On Windows, `detached: true` is load-bearing for a completely different
+ * reason, proven with a minimal control experiment (a plain `node -e`
+ * heartbeat writer — see git history): a NON-detached Windows child is
+ * killed by the OS itself the instant this process is torn down, via
+ * Windows Job Object semantics (Node/libuv ties a non-detached child to a
+ * job object that closes, killing every member, when the owner's own job
+ * handle closes) — regardless of what the child is doing. `detached: true`
+ * escapes that job and reliably survives (confirmed: 60s+ of continued
+ * heartbeats past the owner's death). PowerShell was the original design
+ * for the Windows script, but BOTH available hosts (legacy `powershell`
+ * and `pwsh`) die within ~200ms of being spawned with `detached: true`,
+ * before running a single line — so the Windows watchdog is `node` running
+ * a small generated `.js` file instead (see windowsScriptContent), since
+ * plain `node` IS proven to survive `detached: true` here. Its stdin is
+ * `"ignore"` — it polls for this process's death rather than reading
+ * anything, so there is no pipe to leak into any later child this process
+ * spawns either. All other stdio is `"ignore"` (or, under
+ * `RIGHTSIZE_REAPER_DEBUG`, captured to files) so CI runners never hang on
+ * an inherited handle.
+ */
+export async function spawnWatchdog(opts) {
+    const scriptPath = await ensureWatchdogScript(opts.cacheDir);
+    const interpreter = process.platform === "win32" ? process.execPath : "sh";
+    const baseArgs = [scriptPath];
+    const argv = [
+        ...baseArgs,
+        opts.sandboxesPath,
+        opts.networksPath,
+        opts.recordPath,
+        joinPrefix(opts.killCommand.stop),
+        joinPrefix(opts.killCommand.remove),
+        joinPrefix(opts.killCommand.removeNetwork),
+        ...(process.platform === "win32" ? [String(opts.ownerPid)] : []),
+    ];
+    const debug = reaperDebugEnabled();
+    const runId = runIdFromSandboxesPath(opts.sandboxesPath);
+    const debugPaths = debug ? watchdogDebugPaths(opts.cacheDir, runId) : undefined;
+    if (debugPaths !== undefined) {
+        fsSync.mkdirSync(watchdogDir(opts.cacheDir), { recursive: true });
+    }
+    // Normally "ignore" (CI runners must never hang on an inherited handle);
+    // under RIGHTSIZE_REAPER_DEBUG=1 the watchdog's own stdout/stderr are
+    // instead captured to files so a failing run can show what the script
+    // itself printed rather than nothing at all. Stdin is "pipe" only on
+    // POSIX — see this function's doc.
+    const stdin = process.platform === "win32" ? "ignore" : "pipe";
+    const stdio = debugPaths === undefined
+        ? [stdin, "ignore", "ignore"]
+        : [stdin, fsSync.openSync(debugPaths.out, "a"), fsSync.openSync(debugPaths.err, "a")];
+    const child = spawn(interpreter, argv, {
+        detached: true,
+        windowsHide: true,
+        stdio,
+    });
+    if (debugPaths !== undefined) {
+        appendDebugLine(debugPaths.meta, `spawn interpreter=${interpreter} pid=${child.pid ?? "unknown"} argv=${JSON.stringify(argv)}`);
+        child.once("error", (err) => {
+            appendDebugLine(debugPaths.meta, `spawn error: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
+        });
+        child.once("exit", (code, signal) => {
+            appendDebugLine(debugPaths.meta, `exit code=${code ?? "null"} signal=${signal ?? "null"}`);
+        });
+    }
+    else {
+        // Always listen for 'error', debug or not: an unlistened 'error' event
+        // on a ChildProcess is an uncaught exception in this process, and a
+        // failed watchdog spawn (e.g. the interpreter missing from PATH) must
+        // stay best-effort like every other reaper failure mode, never crash
+        // the host application.
+        child.once("error", () => { });
+    }
+    child.unref();
+    // child.stdin is typed as the generic Writable interface, but for a
+    // "pipe" stdio entry Node always backs it with a net.Socket, which DOES
+    // expose unref() — without this, the held write end would keep this
+    // process's event loop alive even though child.unref() already detached
+    // the child itself. A no-op on Windows, where stdin is "ignore" and
+    // child.stdin is null.
+    const stdinSocket = child.stdin;
+    stdinSocket?.unref?.();
+    return {
+        process: child,
+        closeForTests: () => {
+            child.stdin?.end();
+        },
+    };
+}
+//# sourceMappingURL=watchdog.js.map

package/dist/core/reaper/watchdog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watchdog.js","sourceRoot":"","sources":["../../../src/core/reaper/watchdog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAelC,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7E,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI,KAAK,CAAC;AACtF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB;IACzB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmDR,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,SAAS,oBAAoB;IAC3B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkGR,CAAC;AACF,CAAC;AAED,4JAA4J;AAC5J,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;IAC7F,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,OAAO,UAAU,CAAC,CAAC,+DAA+D;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACnD,MAAM,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,8EAA8E;QAC9E,MAAM,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,MAA6B;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB;IACzB,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,KAAK,GAAG,CAAC;AACvD,CAAC;AAED,kFAAkF;AAClF,SAAS,sBAAsB,CAAC,kBAA0B;IACxD,OAAO,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,KAAa;IAChE,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,KAAK,gBAAgB,CAAC;QACtD,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,KAAK,gBAAgB,CAAC;QACtD,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,KAAK,iBAAiB,CAAC;KACzD,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,eAAuB,EAAE,GAAW;IACpE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,IAAY;IACrD,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,oCAAoC;IACtC,CAAC;AACH,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA0B;IAC5D,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG;QACX,GAAG,QAAQ;QACX,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,YAAY;QACjB,IAAI,CAAC,UAAU;QACf,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QACjC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;QACnC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC;QAC1C,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IAEF,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,mCAAmC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,MAAM,KAAK,GACT,UAAU,KAAK,SAAS;QACtB,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAC7B,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAE1F,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE;QACrC,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,IAAI;QACjB,KAAK;KACN,CAAC,CAAC;IAEH,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,eAAe,CACb,UAAU,CAAC,IAAI,EACf,qBAAqB,WAAW,QAAQ,KAAK,CAAC,GAAG,IAAI,SAAS,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC9F,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC1B,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAClC,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,IAAI,IAAI,MAAM,WAAW,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,qEAAqE;QACrE,wBAAwB;QACxB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,oEAAoE;IACpE,wEAAwE;IACxE,oEAAoE;IACpE,wEAAwE;IACxE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,WAAW,GAAG,KAAK,CAAC,KAAiD,CAAC;IAC5E,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC;IAEvB,OAAO;QACL,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,GAAG,EAAE;YAClB,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/reuse/env.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The second half of reuse's double opt-in (see `GenericContainer.withReuse`
+ * for the first half, the API marker): exactly `"true"` or `"1"`, matching
+ * the feature spec's own wording. Any other value — including a
+ * near-miss like `"True"` or `"yes"` — is treated as disabled, the same
+ * strict-match convention as the rest of this library's boolean-shaped env
+ * vars (unlike `RIGHTSIZE_REAPER`, whose unrecognized values fall back to
+ * its safe default rather than "off": reuse's safe default IS off, so an
+ * unrecognized value staying off needs no special-casing here at all).
+ */
+export declare function reuseEnabled(env: Record<string, string | undefined>): boolean;
+//# sourceMappingURL=env.d.ts.map

package/dist/core/reuse/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../src/core/reuse/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAG7E"}

package/dist/core/reuse/env.js

@@ -0,0 +1,15 @@
+/**
+ * The second half of reuse's double opt-in (see `GenericContainer.withReuse`
+ * for the first half, the API marker): exactly `"true"` or `"1"`, matching
+ * the feature spec's own wording. Any other value — including a
+ * near-miss like `"True"` or `"yes"` — is treated as disabled, the same
+ * strict-match convention as the rest of this library's boolean-shaped env
+ * vars (unlike `RIGHTSIZE_REAPER`, whose unrecognized values fall back to
+ * its safe default rather than "off": reuse's safe default IS off, so an
+ * unrecognized value staying off needs no special-casing here at all).
+ */
+export function reuseEnabled(env) {
+    const raw = env["RIGHTSIZE_REUSE"];
+    return raw === "true" || raw === "1";
+}
+//# sourceMappingURL=env.js.map

package/dist/core/reuse/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../../src/core/reuse/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,GAAuC;IAClE,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnC,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC;AACvC,CAAC"}

package/dist/core/reuse/hash.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The reuse-relevant subset of a container's builder state — everything
+ * that busts identity if it changes, and nothing else (host ports, the
+ * process's `RunId`, network topology, and `readOnly` are all deliberately
+ * absent). This is the cross-language contract: a Kotlin or Rust rightsize
+ * process hashing the "same" logical spec must reach the identical digest,
+ * so every field here, and the canonical form `reuseHash` builds from it,
+ * is part of the wire format, not an implementation detail.
+ */
+export interface ReuseIdentitySpec {
+    readonly image: string;
+    /** Array of pairs, not a Map — mirrors `ContainerSpec.env`. Order does not affect the hash (canonicalized by sorting on key). */
+    readonly env: ReadonlyArray<readonly [string, string]>;
+    /** `undefined` and `[]` hash identically — both mean "no command override". */
+    readonly command: ReadonlyArray<string> | undefined;
+    /** Order does not affect the hash (canonicalized by sorting ascending). */
+    readonly exposedPorts: ReadonlyArray<number>;
+    readonly memoryLimitMb: number | undefined;
+    /** Order does not affect the hash (canonicalized by sorting on `guestPath`); content is hashed from `hostPath` at call time. */
+    readonly copies: ReadonlyArray<{
+        readonly guestPath: string;
+        readonly hostPath: string;
+    }>;
+}
+/**
+ * sha256 over the canonical JSON serialization of `spec`'s reuse-relevant
+ * fields, as a lowercase hex digest — identical across every rightsize
+ * language implementation for the same logical spec (see the feature spec's
+ * pinned contract vector, asserted against this function in `hash.test.ts`).
+ */
+export declare function reuseHash(spec: ReuseIdentitySpec): Promise<string>;
+/** `rz-reuse-<first 12 hex chars of hash>` — the reuse sandbox naming convention (addendum). */
+export declare function reuseName(hash: string): string;
+//# sourceMappingURL=hash.d.ts.map

package/dist/core/reuse/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../../src/core/reuse/hash.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iIAAiI;IACjI,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACpD,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,gIAAgI;IAChI,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3F;AA0DD;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAGxE;AAED,gGAAgG;AAChG,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C"}

package/dist/core/reuse/hash.js

@@ -0,0 +1,52 @@
+import { createHash } from "node:crypto";
+import * as fsp from "node:fs/promises";
+function compareStrings(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+async function hashFileContent(hostPath) {
+    const content = await fsp.readFile(hostPath);
+    return createHash("sha256").update(content).digest("hex");
+}
+/**
+ * Builds the canonical JSON serialization the spec pins: a fixed key order
+ * (`image, env, command, exposedPorts, memoryLimitMb, copies`), env as an
+ * object with keys inserted in sorted order, `command` normalized to `[]`
+ * when unset, ports sorted ascending, `memoryLimitMb` normalized to `null`
+ * when unset, and copies sorted by `guestPath` with each entry's content
+ * read from `hostPath` and hashed. No whitespace — plain `JSON.stringify`
+ * already produces none.
+ */
+async function canonicalize(spec) {
+    const env = {};
+    for (const [key, value] of [...spec.env].sort(([a], [b]) => compareStrings(a, b))) {
+        env[key] = value;
+    }
+    const copies = await Promise.all(spec.copies.map(async (copy) => ({
+        guestPath: copy.guestPath,
+        sha256: await hashFileContent(copy.hostPath),
+    })));
+    copies.sort((a, b) => compareStrings(a.guestPath, b.guestPath));
+    return {
+        image: spec.image,
+        env,
+        command: spec.command ?? [],
+        exposedPorts: [...spec.exposedPorts].sort((a, b) => a - b),
+        memoryLimitMb: spec.memoryLimitMb ?? null,
+        copies,
+    };
+}
+/**
+ * sha256 over the canonical JSON serialization of `spec`'s reuse-relevant
+ * fields, as a lowercase hex digest — identical across every rightsize
+ * language implementation for the same logical spec (see the feature spec's
+ * pinned contract vector, asserted against this function in `hash.test.ts`).
+ */
+export async function reuseHash(spec) {
+    const canonical = await canonicalize(spec);
+    return createHash("sha256").update(JSON.stringify(canonical)).digest("hex");
+}
+/** `rz-reuse-<first 12 hex chars of hash>` — the reuse sandbox naming convention (addendum). */
+export function reuseName(hash) {
+    return `rz-reuse-${hash.slice(0, 12)}`;
+}
+//# sourceMappingURL=hash.js.map

package/dist/core/reuse/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../../src/core/reuse/hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AAsCxC,SAAS,cAAc,CAAC,CAAS,EAAE,CAAS;IAC1C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAgB;IAC7C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAAC,IAAuB;IACjD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;KAC7C,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhE,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG;QACH,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;QAC3B,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1D,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;QACzC,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAuB;IACrD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,YAAY,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzC,CAAC"}

package/dist/core/reuse/registry.d.ts

@@ -0,0 +1,50 @@
+/**
+ * One `reuse/<hash>.json` record: written atomically after a reused
+ * container's first fresh boot passes its wait strategy, and read by every
+ * later `start()` (in this process or a later one) that computes the same
+ * `hash` to decide whether to adopt instead of create. Every field here is
+ * part of the cross-language contract — a Kotlin or Rust process must be
+ * able to parse exactly this shape.
+ */
+export interface ReuseRegistryEntry {
+    readonly name: string;
+    readonly image: string;
+    /** `{"<guestPort>": <hostPort>, ...}` — JSON object keys are always strings, so the guest port is stringified. */
+    readonly ports: Record<string, number>;
+    readonly createdIso: string;
+    /** The backend name (e.g. `"microsandbox"`, `"docker"`) that created this sandbox — informational; adopt always re-verifies liveness through the CURRENTLY active backend regardless of this value. */
+    readonly backend: string;
+}
+/** `<cacheDir>/reuse` — the directory every reuse registry file lives under. */
+export declare function reuseDir(cacheDir: string): string;
+/** `reuse/<hash>.json`. */
+export declare function reusePath(cacheDir: string, hash: string): string;
+/** The three outcomes reading a registry file can settle to — corrupt is deliberately distinct from missing, since the adopt path best-effort-cleans up a stale SANDBOX only for the former (see the reuse spec's stale/corrupt-registry fallback). */
+export type RegistryReadResult = {
+    readonly kind: "missing";
+} | {
+    readonly kind: "corrupt";
+} | {
+    readonly kind: "found";
+    readonly entry: ReuseRegistryEntry;
+};
+/**
+ * Reads and parses `reuse/<hash>.json`. `"missing"` means the file does not
+ * exist at all (the common "never created yet" case); `"corrupt"` means it
+ * exists but isn't a well-shaped `ReuseRegistryEntry` — malformed JSON or a
+ * missing/mistyped required field — distinct from `"missing"` because the
+ * adopt path's fallback behavior differs (see `hash.ts`'s sibling module doc
+ * and the reuse spec).
+ */
+export declare function readRegistry(cacheDir: string, hash: string): Promise<RegistryReadResult>;
+/**
+ * Atomically writes `reuse/<hash>.json` (tmp file + rename, same protocol as
+ * the reaping ledger's `writeRunRecord`) — called once, after a fresh reuse
+ * container's wait strategy has confirmed readiness. A concurrent reader
+ * only ever observes either the previous complete file or this one, never a
+ * partial write.
+ */
+export declare function writeRegistryAtomic(cacheDir: string, hash: string, entry: ReuseRegistryEntry): Promise<void>;
+/** Best-effort delete of `reuse/<hash>.json`. A file already gone is not an error. */
+export declare function removeRegistry(cacheDir: string, hash: string): Promise<void>;
+//# sourceMappingURL=registry.d.ts.map

package/dist/core/reuse/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/core/reuse/registry.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kHAAkH;IAClH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uMAAuM;IACvM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,2BAA2B;AAC3B,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAsBD,uPAAuP;AACvP,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAEnE;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAiB9F;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlH;AAED,sFAAsF;AACtF,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF"}